The Department for Communities and Local Government (DCLG) Information Management Assessment Action Plan

### R1

**DCLG must further define the corporate aims and outcomes for information management in the department, ensuring minimum compliance with statutory requirements.** These aims need to continue to explicitly support corporate outcomes set out in the new departmental business plan.

- This must be a corporate priority now that the new business plan has been published and should not wait for the outcome of the IT procurement exercise.
- Prioritisation of outcomes must take into account what can be realistically achieved by the organisation with the resources allocated to it.
- The CIO and SIRO need to assume responsibility for ensuring minimum statutory compliance and support for the implementation of these objectives.
- DCLG needs to review and reissue its statement concerning its appetite for risk in regard to information assurance as a key underpin to its knowledge and information.

| R1 Actions | Priority: High/Low/Medium | Timescale | Owner | Observations | Delivered? Yes/No | |------------|---------------------------|-----------|-------|--------------|------------------| | **Action 1.1** Review and refresh the Department’s knowledge management strategy in the light of the new business plan | High | 30/09/13 | DS | | | | **Action 1.2** Agree approach for improving centralised knowledge and control of and access to repositories for electronic records | Medium | 31/03/13 | JK/RW | | | | **Action 1.3** Update our risk appetite, using the template issued by SCARAB | High | 30/04/13 | DS | | |

### R2

**DCLG needs to define the remit and priorities of Corporate Records Management Services (CRMS).** Following recommendation 1, CRMS needs to define a plan, including time-bound milestones to ensure corporate goals for information management are reached. Actions must be clearly defined and the benefit to the business articulated.

- The plan must clearly define and prioritise actions according to business need.

- The plans must identify actions to raise the information management understanding and capability of staff. The Department for Communities and Local Government (DCLG) Information Management Assessment Action Plan

- The plan must be accompanied by an implementation plan.

- DCLG and CRMS should consider setting up an internal service standard.

- CRMS and IT must ensure that the CRMS plan is integrated with the IT strategy.

- Monitoring of compliance and progress needs to be established and owned at a suitable level within DCLG.

| R2 Actions | Priority: High/Low/Medium | Timescale | Owner | Observations | Delivered? Yes/No | |------------|---------------------------|-----------|-------|--------------|------------------| | Action 2.1 Prepare IMA Action plan and commence implementation | High | 28/02/13 | DS/JK | | |

R3 DCLG needs to define appropriate metrics and monitor progress against information management outcomes (according to corporate priorities in recommendations 1 and 2) if it is to drive positive change throughout DCLG.

- This should include performance against mailbox and personal drive reduction targets, AFP usage and the application of retention in corporate repositories.
- Monitoring of performance should be the responsibility of the DRO, escalated to the CIO and SIRO when necessary.

| R3 Actions | Priority High/Low/Medium | Timescale | Owner | Observations | Delivered? Yes/No | |------------|--------------------------|-----------|-------|--------------|------------------| | Action 3.1 Monitor mailboxes on a monthly basis, circulating to CIO and SIRO as necessary | High | 31/01/13 | DS/AP | | Yes | | Action 3.2 Identify ownership of drives across the Department, and data orphaned by structural changes | High | Quarter 1 2013 | JK/RW/AP | | | | Action 3.3 Liaise with IT to ensure that P drive recycle bins are automatically deleted | Medium | 31/03/13 | AP | | | | Action 3.4 Initiate a strategy for P: drives | Medium | Quarter 2 2013 | JK/AP | | |

R4 DCLG needs to ensure that management promotes and monitors compliance with corporate policy for information management.

- DCLG needs to monitor non-compliance with policy and define appropriate sanctions. Where technically possible, CRMS must be given appropriate permissions to access divisional drives to allow oversight of compliance with policy.

The SIRO and CIO need to establish formal lines of communication to ensure that information management risks are visible and easily escalated.

| R4 Actions | Priority | Timescale | Owner | Observations | Delivered ? Yes/No | |------------|----------|-----------|-------|--------------|--------------------| | Action 4.1 See action 3.2 | | | | | | | Action 4.2 Prepare policy on deletion processes and use as springboard to highlight need to follow RM procedures for electronic records | High | Quarter 1 2013 | AP | | | | Action 4.3 Conduct assessment against IAMM | Low | 2013 | AP/DS | | |

CRMS must ensure that policies and guidance are aligned with the corporate priorities for information management (as defined by DCLG in recommendation 1).

- Policies need to be accompanied by an implementation plan based on DCLG prioritisation.
- As a matter of urgency, DCLG should create and distribute easy to use guidance based on the fundamental information management priorities.
- The head of Knowledge and information Access needs to continue to provide specific policy and guidance on:
  - FOIA and the application of exemptions as these develop

| R5 Actions | Priority | Timescale | Owner | Observations | Delivered ? Yes/No | |------------|----------|-----------|-------|--------------|--------------------| | Action 5.1 Redesign intranet pages to provide “easy to use guidance” and promote these across Department | High | 28/02/2013 | AP | | | | Action 5.2 KIA to monitor any changes to legislative framework and update guidance accordingly | Medium | Ongoing | MC | | | The Department for Communities and Local Government (DCLG) Information Management Assessment Action Plan

### R6

**DCLG needs to understand the information that it holds, where it is stored and how it needs to be used.** This will support the department in identifying how information needs to be managed in order to ensure statutory compliance.

- DCLG needs to agree ownership and responsibility for maintaining the departmental and Divisional Information Asset Registers (IARs) and how they will be used to inform risk and management decisions.
- CRMS, with the support of the CIO and SIRO, needs to ensure that Divisions are actively engaging in the process of recording the information that it creates and holds. DCLG also needs to continue to define what its key information assets are, where they are stored and how they need to be managed.
- DCLG should work with The National Archives to ensure that maximum benefit can be gained from its IAR ahead of the forthcoming ICT re-let. This includes increasing understanding of technological dependencies and usability requirements.
- DCLG needs to develop a clear strategy for aligning its current Information Asset Register into wider Government data and information reviews, such as the forthcoming Data Inventory, ensuring all information assets are accounted for.

| R6 Actions | Priority | Timescale | Owner | Observations | Delivered | |------------|----------|-----------|-------|--------------|-----------| | Action 6.1 Embed annual updates to the information asset register into the sign-off of the annual governance statement | High | 31/01/13 | DS/AP | | | | Action 6.2 Liaise with Open Data colleagues and Cabinet Office to feed into development of data inventory if appropriate | Low | Cabinet Office to advise | AP | | | | Action 6.3 Refresh Information Asset Register in light of new Government Classification Scheme and identify any concerns arising from the IT re-let | Medium | 30/06/2013 | AP | | |

### R7

**CRMS must implement its action plan to ensure compliance with the 20 year rule change.**

- DCLG needs to ensure it has comprehensively planned its resource allocation to cope with the increased volume of review required for both

### R7 Actions

| Action | Priority | Timescale | Owner | Observations | Delivered? | |--------|----------|-----------|-------|--------------|------------| | **Action 7.1** Produce implementation plan and review quarterly | High | Every quarter | DD | | | | **Action 7.2** Review progress on quarterly basis and report to DRO/TNA | Medium | Every quarter | DD | | | | **Action 7.3** Highlight challenges and risks and update quarterly | Medium | Every quarter | DD | | | | **Action 7.4** Identify key events likely to be of significant historical importance and target resources accordingly | Medium | Every quarter | DD | | |

### R8

**CRMS needs to ensure compliance with What To Keep and retention schedules in conjunction with Divisions** to ensure that DCLG is capturing the records that it requires and that these are retained and destroyed in line with statutory obligations.

- Senior level ownership for specific legislative compliance should be defined.
- DCLG must evaluate the full range of its legislative obligations and define minimum measures for compliance with these.
- DCLG needs to ensure that staff are aware of available guidance. Managers need to be aware of their responsibilities to promote and ensure compliance with policy and legislation.
- DCLG would benefit from using a reinvigorated Business Records Officer (BRO) network to champion and encourage good practice in this regard.

| Action | Priority | Timescale | Owner | Observations | Delivered? | |--------|----------|-----------|-------|--------------|------------| | **Action 8.1** Refresh and re-circulate the ‘What to keep’ guidance to the BRO network once re-established | Medium | Quarter 2 2013 | AP | | | | **Action 8.2** Launch new intranet pages with communications to all BROs highlighting | High | 31/03/13 | AP | | |

### Action 8.3

Develop a deletion policy to sit alongside retention policy, outlining when information should be considered ‘destroyed’

| Priority | Timescale | Owner | |----------|-----------|-------| | High | 31/03/13 | AP/JK/DS |

### Action 8.4

Develop a plan for the introduction of new ASDs across the Department, incorporating any requirements arising from the IT re-let

| Priority | Timescale | Owner | |----------|-----------|-------| | High | Quarter 1 2013 | JK/RW |

### R9

DCLG must reduce the personal size limit for email to levels congruent with other government departments. Use of personal drives must also be addressed.

- A phased reduction is required with individual targets linked to the migration to the new IT re-let schedule.
- Corporate targets must be decided and monitored by CIO, SIRO and DRO.

| R9 Actions | Priority | Timescale | Owner | Observations | Delivered? | |------------|----------|-----------|-------|--------------|------------| | Action 9.1 Agree targets for reduction of mailboxes with CIO | High | 31/12/12 | DS | | Yes | | Action 9.2 Plan and instigate communications regarding mailbox reduction | High | 31/03/13 | AP/JK/DS | | | | Action 9.3 Reduce mailboxes across the Department to 500MB | High | Commence by 31/03/13 | AP/JK/DS | | | | Action 9.4 Provide Livelink to ministerial teams to enable them to reduce their mailboxes to more manageable levels | Medium | 31/03/13 | AP | | |

### R10

DCLG needs to ensure that the action taken to review and dispose of digital information is fully risk-assessed against compliance with legislative and business requirements. This is because retrospective application of retention raises the risk that of deleting records and information that retain value to the organisation or as a public record.

| R10 Actions | Priority | Timescale | Owner | Observations | Delivered? | |-------------|----------|-----------|-------|--------------|------------| | Action 10.1 Develop a policy on the lifecycle management of electronic records and how that policy | High | Quarter 1 2013 | JK/RW | | | The Department for Communities and Local Government (DCLG) Information Management Assessment Action Plan

**Action 10.2** Review the above policy before completion to ensure it meets legislative and business requirements.

______________________________________________________________________

**R11** DCLG must ensure that all technology change projects meet its information requirements.

- DCLG needs to develop a strategy for managing Digital Continuity.
- DCLG needs to ensure that information requirements are central to all technology change planning and projects, through the adoption of formal structures such as a technology change board. The National Archives Digital continuity guidance will support the department as it embeds good practice in to policies and processes.
- CRMS and IT must continue to run the digital continuity self assessment tool based on future electronic records held in Nearline Network Attached Storage and those held by TNT storage, and take appropriate mitigating action where risk is identified.

| R11 Actions | Priority | Timescale | Owner | Observations | Delivered? Yes/No | |-------------|----------|-----------|-------|--------------|-------------------| | Action 11.1 Establish liaison role with IT team | High | 31/03/13 | AP/JK | | | | Action 11.2 Ensure that RM requirements are embedded in IT re-let project plans | High | 31/01/13 | DS | | Yes |

______________________________________________________________________

**R12** DCLG should take the opportunity to consider information security requirements ahead of the IT re-let with particular regard to striking the right balance between protecting and sharing information.

| R12 Actions | Priority | Timescale | Owner | Observations | Delivered? Yes/No | |-------------|----------|-----------|-------|--------------|-------------------| | Action 12.1 See 1.3 – risk appetite | | | | | | | Action 12.2 Embed new Government Classification Scheme across Department | Medium | 30/06/13 or as set by Cabinet | DS/AP | | | DCLG should re-invigorate the network of effective Business Records Officers (BROs) with sufficient coverage, appropriate delegation of authority, training and monitoring. This will enable DCLG to disseminate best practice and drive compliance, to ensure a minimum standard of consistent good practice in order to meet minimum statutory requirements, including compliance with the Public Record Act, Freedom of Information Act and the Data Protection Act.

- CRMS need to engage with BROs to create local What to Keep schedules for Divisions. These must be reviewed regularly.
- DCLG must ensure that the BRO network is maintained. CRMS needs to provide leadership and direction and coordinate activities.
- CRMS must provide updated guidance and training for the role. CRMS should also take a lead in sharing and disseminating good practice.

| Actions | Priority | Timescale | Owner | Observations | Delivered? | |---------|----------|-----------|-------|--------------|------------| | Action 13.1 Establish single up-to-date list of current BROs, filling in gaps resulting from restructure | High | 28/02/13 | AP | | | | Action 13.2 Refresh guidance documents available to BROs to reflect the current needs for their role | Medium | 31/03/13 | AP | | | | Action 13.3 Build BRO responsibilities into any new technology and into the managed service under the new IT contractor | High | 30/09/13 | AP/JK | | |